## template:jinja
# The top level settings are used as module
# and base configuration.
{% set is_bsd = variant in ["dragonfly", "freebsd", "netbsd", "openbsd"] %}
{% set is_rhel = variant in ["almalinux", "centos", "cloudlinux", "eurolinux",
                             "miraclelinux", "rhel", "rocky", "virtuozzo"] %}
{% set gecos = ({"amazon": "EC2 Default User", "azurelinux": "Azure Linux",
                 "centos": "Cloud User", "debian": "Debian",
                 "dragonfly": "DragonFly", "freebsd": "FreeBSD",
                 "mariner": "MarinerOS", "rhel": "Cloud User",
                 "netbsd": "NetBSD", "openbsd": "openBSD",
                 "openmandriva": "OpenMandriva admin", "photon": "PhotonOS",
                 "raspberry-pi-os": "Raspberry Pi OS",
                 "ubuntu": "Ubuntu", "unknown": "Ubuntu"}) %}
{% set groups = ({"alpine": "adm, wheel", "aosc": "wheel", "arch": "wheel, users",
                  "azurelinux": "wheel",
                  "debian": "adm, audio, cdrom, dialout, dip, floppy, netdev, plugdev, sudo, video",
                  "gentoo": "users, wheel", "mariner": "wheel",
                  "photon": "wheel",
                  "openmandriva": "wheel, users, systemd-journal",
                  "raspberry-pi-os": "adm, dialout, cdrom, audio, users, sudo, video, games, plugdev, input, gpio, spi, i2c, netdev, render, lpadmin",
                  "suse": "cdrom, users",
                  "ubuntu": "adm, cdrom, dip, lxd, sudo",
                  "unknown": "adm, cdrom, dip, lxd, sudo"}) %}
{% set shells = ({"alpine": "/bin/ash", "dragonfly": "/bin/sh",
                  "freebsd": "/bin/tcsh", "netbsd": "/bin/sh",
                  "openbsd": "/bin/ksh"}) %}
{% set usernames = ({"amazon": "ec2-user", "centos": "cloud-user",
                     "openmandriva": "omv", "raspberry-pi-os": "pi",
                     "rhel": "cloud-user",
                     "unknown": "ubuntu"}) %}
{% if is_bsd %}
syslog_fix_perms: root:wheel
{% elif variant == "suse" %}
syslog_fix_perms: root:root
{% endif %}

# A set of users which may be applied and/or used by various modules
# when a 'default' entry is found it will reference the 'default_user'
# from the distro configuration specified below
users:
{% if variant == "photon" %}
  - name: root
    lock_passwd: false
{% else %}
  - default
{% endif %}

{% if variant == "photon" %}
# VMware guest customization.
disable_vmware_customization: true
manage_etc_hosts: false

{% endif -%}

# If this is set, 'root' will not be able to ssh in and they
# will get a message to login instead as the default $user
{% if variant in ["freebsd", "photon"] %}
disable_root: false
{% else %}
disable_root: true
{% endif %}

{%- if variant in ["alpine", "amazon", "fedora", "OpenCloudOS", "openeuler",
                   "openmandriva", "photon", "TencentOS"] or is_rhel %}

{% if is_rhel %}
mount_default_fields: [~, ~, 'auto', 'defaults,nofail,x-systemd.after=cloud-init-network.service,_netdev', '0', '2']
{% else %}
mount_default_fields: [~, ~, 'auto', 'defaults,nofail', '0', '2']
{% endif %}
{% if variant == "amazon" %}
resize_rootfs: noblock
{% endif %}
{% if variant not in ["photon"] %}
ssh_pwauth: false
{% endif %}
{% endif %}

# This will cause the set+update hostname module to not operate (if true)
preserve_hostname: false

{% if variant == "debian" %}
apt:
  # This prevents cloud-init from rewriting apt's sources.list file,
  # which has been a source of surprise.
  preserve_sources_list: true

{% endif -%}

# If you use datasource_list array, keep array items in a single line.
# If you use multi line array, ds-identify script won't read array items.
# Example datasource config
# datasource:
#   Ec2:
#     metadata_urls: [ 'blah.com' ]
#     timeout: 5 # (defaults to 50 seconds)
#     max_wait: 10 # (defaults to 120 seconds)

{% if variant == "amazon" %}
# Amazon Linux relies on ec2-net-utils for network configuration
network:
  config: disabled

{% endif -%}

{% if is_rhel %}
# Default redhat settings:
ssh_deletekeys: true
ssh_genkeytypes: ['rsa', 'ecdsa', 'ed25519']
syslog_fix_perms: ~
disable_vmware_customization: false
{% endif -%}

# The modules that run in the 'init' stage
cloud_init_modules:
{% if variant not in ["netbsd"] %}
  - seed_random
{% endif %}
  - bootcmd
  - write_files
{% if variant not in ["netbsd", "openbsd"] %}
  - growpart
  - resizefs
{% endif %}
{% if not is_bsd %}
  - disk_setup
  - mounts
{% endif %}
  - set_hostname
  - update_hostname
  - update_etc_hosts
{% if variant in ["alpine", "photon"] %}
  - resolv_conf
{% endif %}
{% if not is_bsd or variant not in ["photon"] %}
  - ca_certs
{% endif %}
  - rsyslog
  - users_groups
  - ssh
  - set_passwords
{% if variant == "raspberry-pi-os" %}
  - raspberry_pi
{% endif %}

# The modules that run in the 'config' stage
cloud_config_modules:
{% if variant in ["ubuntu"] %}
  - wireguard
{% endif %}
{% if variant in ["debian", "ubuntu", "unknown"] %}
  - snap
{% endif %}
{% if variant == "ubuntu" %}
  - ubuntu_autoinstall
{% endif %}
{% if variant not in ["photon"] %}
  - ssh_import_id
{% if not is_rhel %}
  - keyboard
{% endif %}
  - locale
{% endif %}
{% if variant == "alpine" %}
  - apk_configure
{% elif variant in ["debian", "ubuntu", "unknown"] %}
  - grub_dpkg
  - apt_pipelining
  - apt_configure
{% if variant == "ubuntu" %}
  - ubuntu_pro
{% endif %}
{% elif variant in ["azurelinux", "fedora", "mariner", "openeuler",
                    "openmandriva", "photon"] or is_rhel %}
{% if is_rhel %}
  - rh_subscription
{% endif %}
{% if variant not in ["azurelinux", "mariner", "photon"] %}
  - spacewalk
{% endif %}
  - yum_add_repo
{% elif variant == "suse" %}
  - zypper_add_repo
{% endif %}
  - ntp
  - timezone
{% if variant not in ["azurelinux"] %}
  - disable_ec2_metadata
{% endif %}
  - runcmd
{% if variant in ["debian", "ubuntu", "unknown"] %}
  - byobu
{% endif %}

# The modules that run in the 'final' stage
cloud_final_modules:
  - package_update_upgrade_install
{% if variant in ["debian", "ubuntu", "unknown"] %}
  - fan
  - landscape
  - lxd
{% endif %}
{% if variant in ["ubuntu", "unknown"] %}
  - ubuntu_drivers
{% endif %}
  - write_files_deferred
{% if variant not in ["azurelinux"] %}
  - puppet
  - chef
{% endif %}
  - ansible
{% if variant not in ["azurelinux"] %}
  - mcollective
  - salt_minion
{% if variant not in ["alpine"] %}
  - reset_rmc
{% endif %}
{% endif %}
  - scripts_vendor
  - scripts_per_once
  - scripts_per_boot
  - scripts_per_instance
  - scripts_user
  - ssh_authkey_fingerprints
  - keys_to_console
  - install_hotplug
  - phone_home
  - final_message
  - power_state_change

# System and/or distro specific settings
# (not accessible to handlers/transforms)
system_info:
  # This will affect which distro class gets used
{% if variant in ["alpine", "amazon", "aosc", "arch", "azurelinux", "debian", "fedora",
                  "freebsd", "gentoo", "mariner", "netbsd", "openbsd",
                  "OpenCloudOS", "openeuler", "openmandriva", "photon",
                  "raspberry-pi-os", "suse", "TencentOS", "ubuntu"] or is_rhel %}
  distro: {{ variant }}
{% elif variant == "dragonfly" %}
  distro: dragonflybsd
{% else %}
  # Unknown/fallback distro.
  distro: ubuntu
{% endif %}
  # Default user name + that default users groups (if added/used)
  default_user:
{% if variant in usernames %}
    name: {{ usernames[variant] }}
{% else %}
    name: {{ variant }}
{% endif %}
{% if variant in ["alpine", "amazon", "aosc", "arch", "azurelinux", "debian", "fedora",
                  "gentoo", "mariner", "OpenCloudOS", "openeuler",
                  "openmandriva", "photon", "raspberry-pi-os",
                  "suse", "TencentOS", "ubuntu", "unknown"]
                 or is_bsd or is_rhel %}
    lock_passwd: True
{% endif %}
{% if variant in gecos %}
    gecos: {{ gecos[variant] }}
{% else %}
    gecos: {{ variant }} Cloud User
{% endif %}
{% if variant in groups %}
    groups: [{{ groups[variant] }}]
{% elif is_bsd %}
    groups: [wheel]
{% elif is_rhel %}
    groups: [adm, systemd-journal]
{% else %}
    groups: [wheel, adm, systemd-journal]
{% endif %}
{% if variant == "gentoo" %}
    primary_group: users
    no_user_group: true
{% endif %}
{% if variant in ["alpine", "freebsd", "openbsd"] %}
{% if variant in usernames %}
    doas:
      - permit nopass usernames[{{ variant }}]
{% else %}
    doas:
      - permit nopass {{ variant }}
{% endif %}
{% endif %}
    sudo: ["ALL=(ALL) NOPASSWD:ALL"]
{% if variant in shells %}
    shell: {{ shells[variant] }}
{% else %}
    shell: /bin/bash
{% endif %}
{% if variant == "alpine" %}
  network:
    renderers: ['eni']
{% elif variant == "debian" %}
  network:
    renderers: ['netplan', 'eni', 'networkd']
    activators: ['netplan', 'eni', 'network-manager', 'networkd']
{% elif variant == "dragonfly" %}
  network:
    renderers: ['freebsd']
{% elif variant == "fedora" %}
  network:
    renderers: ['netplan', 'network-manager', 'networkd', 'sysconfig', 'eni']
{% elif variant in ["freebsd", "netbsd", "openbsd"] %}
  network:
    renderers: ['{{ variant }}']
{% elif variant in ["azurelinux", "mariner", "photon"] %}
  network:
    renderers: ['networkd']
{% elif variant == "openmandriva" %}
  network:
    renderers: ['network-manager', 'networkd']
{% elif variant == "raspberry-pi-os" %}
  network:
    renderers: ['netplan', 'network-manager']
    activators: ['netplan', 'network-manager']
{% elif variant in ["ubuntu", "unknown"] %}
{# SRU_BLOCKER: do not ship network renderers on Xenial, Bionic or Eoan #}
  network:
    dhcp_client_priority: [dhcpcd, dhclient, udhcpc]
    renderers: ['netplan', 'eni', 'sysconfig']
    activators: ['netplan', 'eni', 'network-manager', 'networkd']
{% elif is_rhel %}
  network:
    renderers: ['eni', 'netplan', 'network-manager', 'sysconfig', 'networkd']
{% endif %}
{% if variant == "photon" %}
  # If set to true, cloud-init will not use fallback network config.
  # In Photon, we have default network settings, hence if network settings are
  # not explicitly given in metadata, don't use fallback network config.
  disable_fallback_netcfg: true
{% endif %}
{% if variant in ["debian", "ubuntu", "unknown"] %}
  # Automatically discover the best ntp_client
  ntp_client: auto
{% endif %}
{% if variant in ["alpine", "amazon", "aosc", "arch", "azurelinux", "debian", "fedora",
                  "gentoo", "mariner", "OpenCloudOS", "openeuler",
                  "openmandriva", "photon", "suse", "TencentOS", "ubuntu",
                  "unknown"]
                  or is_rhel %}
  # Other config here will be given to the distro class and/or path classes
  paths:
    cloud_dir: /var/lib/cloud/
    templates_dir: /etc/cloud/templates/
{% elif is_bsd %}
  paths:
    run_dir: /var/run/cloud-init/
{% endif %}
{% if variant == "debian" %}
  package_mirrors:
    - arches: [default]
      failsafe:
        primary: https://deb.debian.org/debian
        security: https://deb.debian.org/debian-security
{% elif variant == "raspberry-pi-os" %}
  package_mirrors:
    - arches: [arm64]
      failsafe:
        primary: 
          - https://deb.debian.org/debian
          - http://archive.raspberrypi.com/debian/
        security: https://deb.debian.org/debian-security
    - arches: [armhf]
      failsafe:
        primary: 
          - http://raspbian.raspberrypi.com/raspbian/
          - http://archive.raspberrypi.com/debian/
{% elif variant in ["ubuntu", "unknown"] %}
  package_mirrors:
    - arches: [i386, amd64]
      failsafe:
        primary: http://archive.ubuntu.com/ubuntu
        security: http://security.ubuntu.com/ubuntu
      search:
        primary:
          - http://%(ec2_region)s.ec2.archive.ubuntu.com/ubuntu/
          - http://%(availability_zone)s.clouds.archive.ubuntu.com/ubuntu/
          - http://%(region)s.clouds.archive.ubuntu.com/ubuntu/
        security: []
    - arches: [arm64, armel, armhf]
      failsafe:
        primary: http://ports.ubuntu.com/ubuntu-ports
        security: http://ports.ubuntu.com/ubuntu-ports
      search:
        primary:
          - http://%(ec2_region)s.ec2.ports.ubuntu.com/ubuntu-ports/
          - http://%(availability_zone)s.clouds.ports.ubuntu.com/ubuntu-ports/
          - http://%(region)s.clouds.ports.ubuntu.com/ubuntu-ports/
        security: []
    - arches: [default]
      failsafe:
        primary: http://ports.ubuntu.com/ubuntu-ports
        security: http://ports.ubuntu.com/ubuntu-ports
{% endif %}
{% if variant in ["debian", "raspberry-pi-os", "ubuntu", "unknown"] %}
  ssh_svcname: ssh
{% elif variant in ["alpine", "amazon", "aosc", "arch", "azurelinux", "fedora",
                    "gentoo", "mariner", "OpenCloudOS", "openeuler",
                    "openmandriva", "photon", "suse", "TencentOS"]
                   or is_rhel %}
  ssh_svcname: sshd
{% endif %}